CVE-2026-74388

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free (UAF) issue exists in the ALSA OSS sequencer when handling events with embedded SysEx data. The OSS sequencer processes MIDI bytes into events via snd seq oss midi putc() and snd seq oss process event(). For SysEx data, the event record uses a pointer data.ext.ptr to the original bytes. If the sequencer port is closed concurrently via snd seq oss midi check exit port() before the event is dispatched, the resources are released while the pending event still holds a stale pointer, leading to a UAF during dispatch. This was identified through KASAN reports in the snd seq event dup() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.